add limits to lazy unpacking too

Author: Asmod4n

src/mrb_msgpack.cpp

@@ -918,13 +918,13 @@ mrb_unpack_msgpack_obj(mrb_state* mrb, const msgpack::object& obj)
 
     case msgpack::type::EXT: {
       auto ext_type = obj.via.ext.type();
-      mrb_msgpack_ctx* ctx = MRB_MSGPACK_CONTEXT(mrb);
-      if (ext_type == ctx->ext_type && ctx->sym_unpacker != nullptr) {
-        return ctx->sym_unpacker(mrb, obj);
-      }
       if (ext_type == -1) {
         return mrb_msgpack_unpack_timestamp(mrb, obj);
       }
+      mrb_msgpack_ctx* ctx = MRB_MSGPACK_CONTEXT(mrb);
+      if (ctx->sym_unpacker != nullptr && ext_type == ctx->ext_type) {
+        return ctx->sym_unpacker(mrb, obj);
+      }
       mrb_value unpacker = mrb_hash_get(
         mrb,
         ext_unpackers_hash(mrb),
@@ -1108,11 +1108,18 @@ mrb_msgpack_unpack_lazy_m(mrb_state *mrb, mrb_value self)
       mrb_raise(mrb, E_MSGPACK_ERROR, "ObjectHandle is not initialized");
       return mrb_undef_value();
     }
-
+    msgpack::unpack_limit limit(
+      MSGPACK_ARY_LIMIT,   // array
+      MSGPACK_MAP_LIMIT,   // map
+      MSGPACK_STR_LIMIT,   // str
+      MSGPACK_BIN_LIMIT,   // bin
+      MSGPACK_EXT_LIMIT,   // ext
+      MSGPACK_DEPTH_LIMIT  // depth
+    );
     msgpack::unpack(handle->oh,
                     RSTRING_PTR(data),
                     RSTRING_LEN(data),
-                    handle->off);
+                    handle->off, nullptr, nullptr, limit);
 
     return object_handle;
   }

test/fuzz.rb

@@ -57,10 +57,6 @@ def random_pointer(chars)
 
   # 5) Ext‑Type‑Fuzzing
   begin
-    MessagePack.register_ext_type(42, String,
-      pack: ->(s) { s },
-      unpack: ->(d) { d }
-    )
     MessagePack.unpack(random_bytes(rand(20), chars))
   rescue MessagePack::Error
   end